When one of our users attempts to log into OWA while their account is locked out, they receive a message stating that their username or password was incorrect. Is it possible to configure OWA so that it tells them if their account has been locked out?


No, possibly for security reasons. Users should not know that fact. Well, THE user may want to know, but the HACKER that tries to log in as the user should KNOW know that his password attempt was not rejected for a wrong password but because he got locked out.

Basic security 101 is to give the hacker as little information as possible.

  • Just like when a password is entered wrong, but the dialog box says "username or password not recognized", it gives someone trying to gain unauthorized access no idea which part they have incorrect. – DanBig Jul 17 '12 at 17:31
  • Exactly. As little info as possible. – TomTom Jul 17 '12 at 18:01
  • I get the reasoning behind it, but it's quite frustrating from an end user perspective, and the amount of extra security it provides is minimal. It's very likely that the username will be known to the hacker unless it's a general brute force, in which case password and lockout policies should provide solid protection. Edit: Do you have a reference you can cite, by chance? I'd like to be able to show something to management. Thanks! – bshacklett Jul 20 '12 at 16:01
  • Actually it is not minimal. it is the KEY to lead brute force password cracking attempts directly into a slow death. If you think about it some more time you will realize how bad your statement is about marginal security. – TomTom Jul 20 '12 at 18:04
  • How does the knowledge that an account is locked out help with a brute-force attempt? Once it's locked, that attempt is over and the attacker must move to another method. With reasonable complexity requirements enabled, I find it hard to believe this is much of a concern anyway. An attacker would be lucky to get 100 passwords per second through an OWA prompt, and someone is going to get a call very quickly that the server is being overloaded in that case. That's assuming there is no lockout policy in place. – bshacklett Sep 5 '12 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.